Parameterizied queries do eliminate injection in the cases that they support, but it is not uncommon to need to so some level of query building manually, since

Parameterizied queries do eliminate injection in the cases that they support, but it is not uncommon to need to so some level of query building manually, since not everything you might want to do is supported by parameterized queries. For example one cannot usually do "... order by ? ?", passing in a column name and ascending/descending. And this is commonly needed for say paginated tables where the user can choose which column to sort by. Similarly, I've worked with some advanced seaarch screens that would need to dynamically add additional clauses to "WHERE", and in the end, that will come down to some form of string concatenation, even if parameters get represented as "?" and passed separately. But unfortunately doing that with string concatenation leaves more opportunity for injection errors to slip in. Its actually rather unfortunate pretty much no SQL database allows passing a query as an already parsed AST. It would be really neat if a query builder pattern in software could instead of building up a string could construct a binary representation of the AST, such that no injection was possible, and simply hand it off to the engine. The AST would dictate that this value is a column name, and because we are already an AST, there is no need to escape this value, since the engine won't need to reparse it. Or this value is a string, but once again, no reparsing from string needed, so no escaping needed. (Serialization format could have a length prefix or whatever).